An audit finding is not an attack. It is the only currency with which an understaffed area gets resources from the board.
The reflex is the same everywhere: a finding comes in, and the first thought is defense. Of course you dress up the bride before the auditor arrives. A temporarily untidy shop that ends up in the audit report and travels to the board helps no one. That goes double for external audits, where a seal of approval stands at the end.
With internal audits, though, that is only half the truth. You must not give in to the reflex of faking a perfect shop. A finding is often a signal of a decision needed: do we live with the deficiency, or do we get the means to fix it? Exactly here an audit remark turns into a lever.
Where findings really count
It gets critical in three places: where internal governance is supposed to secure compliance with external laws (labor law, time recording, supply chains), where money goes out (procurement, travel), and where secrecy is vital. When an organization cuts its operational units to the bone out of weak leadership, things are no longer consolidated and therefore no longer process- and audit-proof. Then the permissible working time is simply exceeded, and documented exactly that way. Without investment and resources, no wagging finger cleans that up.
In a Europe-wide compliance program we did not even let it come to an audit. The legal gap was named, planned and closed, with the fitting program and the investment it required. That is the productive reading of a finding: not waiting until it stands in the report, but using it to force the decision.
The head and the fish
I have turned the „finding equals failure“ reflex around almost always in conversation with fearful leaders. Where communication upward is to be minimized, every finding counts as a threat. Convincing employees of the constructive side of an audit is then hard to impossible. The fish rots from the head, and this is just one of its many variants. Where real gaps grind in the audits, they only trigger the snapping reflex („I herewith instruct once more“) instead of a strategic solution through organization, process and tool.
If your area is chronically understaffed, the next audit finding is not an attack on you. It is the one line with which you get resources from the board, provided you do not hide it.
Whoever negotiates away every finding ends up negotiating away their own resources. And those are then missing exactly where the next, bigger finding is already waiting.
